Description

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T13:19:29.677Z",
  "pubdate": "2026-09-14T13:19:29.677Z",
  "executiveSummary": "A denial of service (DoS) vulnerability exists in the vllm-project vLLM library, specifically within the tiktoken vocab file handler component. The vulnerability resides in the TiktokenTokenizer::new function located in rust/src/text/src/backend/hf/mod.rs.\nThe flaw allows a local attacker to cause a service crash by providing a malicious or malformed tiktoken vocabulary file. Because the vulnerability results in a denial of service, it poses a significant risk to the availability of the vLLM inference engine, particularly in environments where users may have local file access or the ability to influence configuration inputs.\nThe attack requires local access to the system to supply the specially crafted input file that triggers the problematic code path during the tokenizer initialization process. Although the issue has been publicly disclosed and exploit code is available, the primary impact remains the termination of the vLLM process, effectively halting model serving capabilities until manually recovered.",
  "technicalDetails": "The vulnerability is located in the TiktokenTokenizer::new function within the rust/src/text/src/backend/hf/mod.rs file. This function is responsible for parsing and initializing vocabulary files using the tiktoken format. The root cause pertains to improper input validation or error handling when the tokenizer processes a malformed or intentionally crafted vocabulary file structure.\nDuring the initialization of a model, vLLM invokes the tokenizer to load the necessary token mapping data. When TiktokenTokenizer::new is called, it attempts to read and deserialize the provided file. If the input file is manipulated, the internal logic may encounter an unhandled exception, a panic, or an out-of-memory condition caused by unexpected data types or sizes within the file structure. Because this occurs during the instantiation phase of the backend handler, the process is unable to gracefully recover, leading to a crash.\nThe attack flow follows a predictable pattern: 1) The attacker gains local access to the filesystem where the vLLM configuration or model artifacts reside. 2) The attacker replaces or injects a malicious tiktoken vocabulary file into the path expected by the vLLM application. 3) The attacker triggers an inference request or an application restart that forces the TiktokenTokenizer::new function to initialize using the malicious file. 4) The library attempts to process the invalid file, triggers a crash (panic) in the Rust runtime, and terminates the main execution thread of the vLLM service.\nThe vulnerability affects all versions of vLLM up to and including 0.29.0. It is classified as a local denial of service vector because it necessitates filesystem-level manipulation to substitute the vocabulary file. The lack of robust input sanitization within the tiktoken backend allows the malformed file to influence the memory management or flow control of the tokenizer, resulting in an abnormal process termination. Post-exploitation impact is limited to system availability; there is no evidence of arbitrary code execution, though the service remains offline until the problematic file is removed or the application is patched."
}